Insights Gleaned from the 2025 Cybersecurity Defense Strategies Conference
Federal Funding Boost for Cybersecurity in Underserved Communities
The Cyber Civil Defense Summit 2025, held at the Ronald Reagan Building and International Trade Center in Washington, D.C., brought together nearly 200 members of the public interest cybersecurity community to discuss the current state of cybersecurity funding in the U.S.
The summit took place during a time of growing uncertainty and upheaval in the cybersecurity field due to changes in the Trump Administration's policies. Despite this, the focus was on exploring how cyber civil defenders can work together to continue advancing their vital work, with or without aid from the federal government.
The theme of the summit was "Collaborative Advantage: Uniting Forces to Achieve More." One of the key topics of discussion was the need for special consideration in federal cybersecurity funding formulas for island territories due to their geographic and economic circumstances.
Another important issue addressed was the role of private companies in cyber civil defense. It was emphasized that private companies can play a greater role, including by embracing secure-by-design principles. Michael Klein, for instance, highlighted the importance of companies being more secure by design to alleviate the burden on under-resourced organizations.
Udbhav Tiwari from Signal called for the cyber civil defenders to ensure spaces for secure, private communications. Signal, a private company, prioritizes data minimization principles and end-to-end encryption to protect user privacy.
The summit also highlighted the efforts of certain states in formulating and advancing prescriptive cybersecurity regulations across critical sectors like electric utilities, water, and healthcare. However, it was noted that cybersecurity regulation remains a rare area of bipartisan agreement within state legislatures, but funding remains the largest barrier to passage.
In a positive development, the current state of federal funding for cybersecurity in U.S. critical infrastructure, particularly targeting underserved communities such as tribal governments, includes over $100 million in FY2025 grants announced by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA).
This funding is split between the State and Local Cybersecurity Grant Program (SLCGP), providing $91.7 million to state and local governments, and the Tribal Cybersecurity Grant Program (TCGP), offering $12.1 million for tribal governments. These grants are intended to help recipients strengthen cyber defenses, support planning, conduct exercises, hire cybersecurity experts, and improve critical digital infrastructure and services for citizens, including those in underserved communities.
The SLCGP and TCGP together represent part of a larger multi-year effort to distribute $1 billion in cybersecurity funding to state, local, tribal, and territorial governments over four years. These programs focus on reducing systemic cyber risks in critical infrastructure and public services that state, local, tribal, and territorial governments manage or operate on behalf of their communities. The funding explicitly aims to empower underserved communities such as tribal governments by allocating a dedicated grant program (TCGP) for them.
The latest funding cycle restricts grant money from being used for certain purposes, including paying ransomware ransoms or insurance premiums, but emphasizes spending on strengthening cyber resilience and capabilities locally.
The Cyber Civil Defense Summit 2025 was sponsored by Craig Newmark Philanthropies, Okta for Good, and Google.org. Event sponsorship opportunities and suggestions for speakers and topics are welcomed for the next Cyber Civil Defense Summit in 2026.
More awareness is needed to inform under-resourced public agencies about free cybersecurity resources available to them. Texas's regional security operations centers offer free cybersecurity incident response services to local governmental entities. The Environmental Protection Agency also offers free cybersecurity assistance and assessments for water and wastewater utilities.
However, it was noted that a 'one-size-fits-all' approach to cybersecurity standards and resourcing often leaves smaller, underserved communities behind. It was suggested that private companies can contribute to cyber civil defense by adopting secure-by-design principles.
The administration has reduced the staff of the Cybersecurity and Infrastructure Security Agency (CISA) by a third and shrunk its budget by 17%. This has raised concerns about the agency's ability to effectively address cybersecurity threats.
Despite these challenges, the Cyber Civil Defense Summit 2025 served as a reminder of the importance of collaboration and cooperation in the face of evolving cyber threats. It underscored the need for a more inclusive and targeted approach to cybersecurity funding, particularly for underserved communities.
[1] CISA (2025). State and Local Cybersecurity Grant Program. Retrieved from https://www.cisa.gov/slcgp
[2] FEMA (2025). Tribal Cybersecurity Grant Program. Retrieved from https://www.fema.gov/tribal-cybersecurity-grant-program
[3] White House (2025). Executive Order on Improving the Nation's Cybersecurity. Retrieved from https://www.whitehouse.gov/briefing-room/presidential-actions/2025/02/09/executive-order-on-improving-the-nations-cybersecurity/
[4] Congressional Research Service (2025). State and Local Cybersecurity Grant Program. Retrieved from https://crsreports.congress.gov/product/pdf/R/R46423
[5] National Governors Association (2025). State and Local Cybersecurity Grant Program. Retrieved from https://www.nga.org/cms/home/policy-issues/cybersecurity/state-and-local-cybersecurity-grant-program/
- The Cyber Civil Defense Summit 2025 emphasized the need for private companies to adopt secure-by-design principles to alleviate the burden on under-resourced organizations.
- Udbhav Tiwari from Signal called for the cyber civil defenders to ensure spaces for secure, private communications, stressing the importance of data minimization principles and end-to-end encryption in protecting user privacy.
- The focus of the summit was on exploring how cyber civil defenders can work together to advance their vital work, with or without federal funding.
- Michael Klein highlighted the importance of companies being more secure by design to help under-resourced organizations facing cybersecurity challenges.
- The latest funding cycle for the State and Local Cybersecurity Grant Program (SLCGP) and the Tribal Cybersecurity Grant Program (TCGP) emphasizes spending on strengthening cyber resilience and capabilities locally, while restricting grant money from being used for certain purposes like paying ransomware ransoms or insurance premiums.
- The SLCGP and TCGP together represent part of a larger multi-year effort to distribute $1 billion in cybersecurity funding to state, local, tribal, and territorial governments over four years.
- The funding explicitly aims to empower underserved communities such as tribal governments by allocating a dedicated grant program (TCGP) for them.
- State legislatures have shown support for prescriptive cybersecurity regulations across critical sectors such as electric utilities, water, and healthcare. However, funding remains the largest barrier to their passage.
- The future of cybersecurity governance requires a more inclusive and targeted approach, considering the unique challenges faced by underserved communities. This includes increased awareness about free cybersecurity resources available to them.
